@pensar/apex 2.7.0-canary.52c132f4 → 2.7.0-canary.91cc2d52

package/build/agent-dwb90wfs.js

@@ -0,0 +1,13 @@
+import {
+  runAuthenticationAgent2
+} from "./cli-rx9g88ws.js";
+import"./cli-3cw5r290.js";
+import"./cli-qba2x69h.js";
+import"./cli-ae6crt8f.js";
+import"./cli-hsk2jkfx.js";
+import"./cli-w14rjr2a.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-e4a4h158.js";
+export {
+  runAuthenticationAgent2 as runAuthenticationAgent
+};

package/build/{agent-ydy5fq92.js → agent-fm79ysyz.js}

@@ -1,15 +1,15 @@
-import"./cli-ene4g09p.js";
-import"./cli-35gz0ahm.js";
-import"./cli-bc793xfp.js";
+import"./cli-ae6crt8f.js";
+import"./cli-e4a4h158.js";
+import"./cli-w14rjr2a.js";
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1wtxf161.js";
+} from "./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-mm2vxyne.js";
+} from "./cli-hsk2jkfx.js";
 import"./cli-c2k4xxaw.js";
 import {
   init_zod

package/build/agent-j2h5dgcj.js

@@ -0,0 +1,13 @@
+import {
+  CodeAgent2
+} from "./cli-m2wpnmhx.js";
+import"./cli-3cw5r290.js";
+import"./cli-qba2x69h.js";
+import"./cli-ae6crt8f.js";
+import"./cli-hsk2jkfx.js";
+import"./cli-w14rjr2a.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-e4a4h158.js";
+export {
+  CodeAgent2 as CodeAgent
+};

package/build/{agent-112gdg69.js → agent-q7hcmhg5.js}

@@ -1,14 +1,14 @@
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-wa52mx4p.js";
-import"./cli-1wtxf161.js";
+} from "./cli-hpbpzy5k.js";
+import"./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
-import"./cli-ene4g09p.js";
-import"./cli-mm2vxyne.js";
-import"./cli-bc793xfp.js";
+import"./cli-ae6crt8f.js";
+import"./cli-hsk2jkfx.js";
+import"./cli-w14rjr2a.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-35gz0ahm.js";
+import"./cli-e4a4h158.js";
 export {
   TargetedPentestAgent2 as TargetedPentestAgent,
   buildPentestSystemPrompt2 as buildPentestSystemPrompt

package/build/{agent-runs-hhjzsysf.js → agent-runs-6nyk8hjx.js}

@@ -1,11 +1,11 @@
 import {
   config2,
   init_config
-} from "./cli-35gz0ahm.js";
-import"./cli-bc793xfp.js";
+} from "./cli-e4a4h158.js";
+import"./cli-w14rjr2a.js";
 import {
   AgentEventBus
-} from "./cli-ene4g09p.js";
+} from "./cli-ae6crt8f.js";
 import {
   inspectSessionEvidence2,
   RecordedRunSpecSchema,
@@ -16,25 +16,25 @@ import {
   runRecordedAgent2,
   RunRecoveryBlockedError2,
   resumeRecordedAgent2
-} from "./cli-ahk627k3.js";
-import"./cli-tb77javm.js";
-import"./cli-np9x97h3.js";
-import"./cli-mpmpfce6.js";
-import"./cli-3158x9wb.js";
-import"./cli-087apjgk.js";
-import"./cli-wa52mx4p.js";
-import"./cli-xe4wq07r.js";
+} from "./cli-d47vhcxp.js";
+import"./cli-w3mk93a4.js";
+import"./cli-m2wpnmhx.js";
+import"./cli-72p3tb5s.js";
+import"./cli-05arm5mj.js";
+import"./cli-rx9g88ws.js";
+import"./cli-hpbpzy5k.js";
+import"./cli-nm0nqnn7.js";
 import"./cli-xcy2vxj2.js";
 import {
   resolveWorkerExecutable,
   launchLocalWorker
-} from "./cli-k8m6737j.js";
-import"./cli-1wtxf161.js";
+} from "./cli-sfpjmf8c.js";
+import"./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
 import {
   buildAuthConfig,
   init_ai
-} from "./cli-mm2vxyne.js";
+} from "./cli-hsk2jkfx.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/agent-runs.ts
@@ -115,7 +115,7 @@ async function runAgentRunsCommand(args) {
     if (!isAbsolute(values.store)) {
       throw new Error("agent-runs worker requires --store <absolute database>");
     }
-    const { serveLocalRunWorker } = await import("./index-269a90mm.js");
+    const { serveLocalRunWorker } = await import("./index-pbftr2x4.js");
     await serveLocalRunWorker({
       runId: values.run,
       databasePath: resolve(values.store)
@@ -129,7 +129,7 @@ async function runAgentRunsCommand(args) {
 ${HELP}`);
   }
   if (command === "attach") {
-    const { openRecordedRunClient } = await import("./recordedRunClient-d7947b0z.js");
+    const { openRecordedRunClient } = await import("./recordedRunClient-647rnnet.js");
     const client = await openRecordedRunClient(values.store);
     const controller = new AbortController;
     const detach = () => controller.abort();

package/build/{apps-v4jc7eqb.js → apps-8athj8ek.js}

@@ -15,24 +15,24 @@ import {
   searchEndpoints2,
   listDomains2,
   createDomain2
-} from "./cli-ene4g09p.js";
-import"./cli-35gz0ahm.js";
-import"./cli-bc793xfp.js";
-import"./cli-ahk627k3.js";
-import"./cli-tb77javm.js";
-import"./cli-np9x97h3.js";
-import"./cli-mpmpfce6.js";
-import"./cli-3158x9wb.js";
-import"./cli-087apjgk.js";
-import"./cli-wa52mx4p.js";
-import"./cli-xe4wq07r.js";
+} from "./cli-ae6crt8f.js";
+import"./cli-e4a4h158.js";
+import"./cli-w14rjr2a.js";
+import"./cli-d47vhcxp.js";
+import"./cli-w3mk93a4.js";
+import"./cli-m2wpnmhx.js";
+import"./cli-72p3tb5s.js";
+import"./cli-05arm5mj.js";
+import"./cli-rx9g88ws.js";
+import"./cli-hpbpzy5k.js";
+import"./cli-nm0nqnn7.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1wtxf161.js";
+import"./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
-import"./cli-mm2vxyne.js";
+import"./cli-hsk2jkfx.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/apps.ts

package/build/{auth-bxkn5pcb.js → auth-xeyjgbvt.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env bun
-import"./cli-ene4g09p.js";
+import"./cli-ae6crt8f.js";
 import {
   config2,
   init_config
-} from "./cli-35gz0ahm.js";
+} from "./cli-e4a4h158.js";
 import {
   getPensarApiUrl2,
   getPensarConsoleUrl2,
@@ -19,22 +19,22 @@ import {
   createWorkspaceSelection2,
   pollWorkspaceSelection2,
   init_auth
-} from "./cli-bc793xfp.js";
-import"./cli-ahk627k3.js";
-import"./cli-tb77javm.js";
-import"./cli-np9x97h3.js";
-import"./cli-mpmpfce6.js";
-import"./cli-3158x9wb.js";
-import"./cli-087apjgk.js";
-import"./cli-wa52mx4p.js";
-import"./cli-xe4wq07r.js";
+} from "./cli-w14rjr2a.js";
+import"./cli-d47vhcxp.js";
+import"./cli-w3mk93a4.js";
+import"./cli-m2wpnmhx.js";
+import"./cli-72p3tb5s.js";
+import"./cli-05arm5mj.js";
+import"./cli-rx9g88ws.js";
+import"./cli-hpbpzy5k.js";
+import"./cli-nm0nqnn7.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1wtxf161.js";
+import"./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
-import"./cli-mm2vxyne.js";
+import"./cli-hsk2jkfx.js";
 import"./cli-c2k4xxaw.js";
 import {
   __require

package/build/{blackboxAgent-260yqknt.js → blackboxAgent-g034embj.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-tb77javm.js";
-import"./cli-1wtxf161.js";
+} from "./cli-w3mk93a4.js";
+import"./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
-import"./cli-ene4g09p.js";
-import"./cli-mm2vxyne.js";
-import"./cli-bc793xfp.js";
+import"./cli-ae6crt8f.js";
+import"./cli-hsk2jkfx.js";
+import"./cli-w14rjr2a.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-35gz0ahm.js";
+import"./cli-e4a4h158.js";
 export {
   BlackboxAttackSurfaceAgent2 as BlackboxAttackSurfaceAgent
 };

package/build/{blackboxPentest-nbn588pb.js → blackboxPentest-jds43wyq.js}

@@ -1,26 +1,26 @@
-import"./cli-35gz0ahm.js";
-import"./cli-bc793xfp.js";
-import"./cli-ene4g09p.js";
-import"./cli-tb77javm.js";
-import"./cli-wa52mx4p.js";
-import"./cli-xe4wq07r.js";
+import"./cli-e4a4h158.js";
+import"./cli-w14rjr2a.js";
+import"./cli-ae6crt8f.js";
+import"./cli-w3mk93a4.js";
+import"./cli-hpbpzy5k.js";
+import"./cli-nm0nqnn7.js";
 import {
   readExecutionMetrics,
   writeExecutionMetrics,
   runPentestWorkflow2
-} from "./cli-3158x9wb.js";
-import"./cli-np9x97h3.js";
-import"./cli-mpmpfce6.js";
+} from "./cli-05arm5mj.js";
+import"./cli-m2wpnmhx.js";
+import"./cli-72p3tb5s.js";
 import {
   EMPTY_SESSION_TOKEN_USAGE,
   accumulateSessionTokens
 } from "./cli-ag6jtndp.js";
-import"./cli-1wtxf161.js";
+import"./cli-3cw5r290.js";
 import"./cli-qba2x69h.js";
 import {
   init_ai,
   normalizeStepUsage
-} from "./cli-mm2vxyne.js";
+} from "./cli-hsk2jkfx.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-3158x9wb.js → cli-05arm5mj.js}

@@ -8,28 +8,29 @@ import {
   resolveItemHooks,
   toGrpcPentestContext,
   grpcAuthorityTarget,
+  spawnBatch,
   inProcessSubagentSpawner,
   pLimit,
   PLAN_MODE_TOOL_NAMES,
   OffensiveSecurityAgent
-} from "./cli-ene4g09p.js";
+} from "./cli-ae6crt8f.js";
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-tb77javm.js";
+} from "./cli-w3mk93a4.js";
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-wa52mx4p.js";
+} from "./cli-hpbpzy5k.js";
 import {
   buildPentestReport,
   renderJson,
   renderMarkdown,
   REPORT_FILENAME_MD,
   REPORT_FILENAME_JSON
-} from "./cli-xe4wq07r.js";
+} from "./cli-nm0nqnn7.js";
 import {
   CodeAgent2
-} from "./cli-np9x97h3.js";
+} from "./cli-m2wpnmhx.js";
 import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
@@ -38,7 +39,7 @@ import {
   AppInfoSchema2,
   AppsDiscoveryResultSchema2,
   DiscoverySummarySchema2
-} from "./cli-mpmpfce6.js";
+} from "./cli-72p3tb5s.js";
 import {
   createThreatModelPrompt
 } from "./cli-q126f6ef.js";
@@ -50,7 +51,7 @@ import {
   init_session,
   createLogger,
   init_structured
-} from "./cli-mm2vxyne.js";
+} from "./cli-hsk2jkfx.js";
 import {
   newSessionId,
   init_id
@@ -758,7 +759,7 @@ This agent is responsible for **exactly one** endpoint. Do not document other en
 4. Call \`response\` with \`{ endpointsDocumented: 1, summary: "<one-line summary>" }\`.
 `;
 }
-async function runEndpointDocumentationAgent(opts) {
+function endpointDocumentationSpawnOptions(opts) {
   const {
     codebasePath,
     app,
@@ -777,8 +778,6 @@ async function runEndpointDocumentationAgent(opts) {
     thinkingEffort,
     projectThreatModel,
     parentSubagentId,
-    agentLimiter,
-    subagentSpawner,
     hooks,
     mintChildId
   } = opts;
@@ -791,8 +790,7 @@ async function runEndpointDocumentationAgent(opts) {
     endpoint,
     frameworks
   });
-  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
-  const spawnChild = () => spawner.spawn({
+  return {
     spec: {
       type: "code",
       codebasePath,
@@ -818,6 +816,7 @@ async function runEndpointDocumentationAgent(opts) {
       sandbox: hooks?.sandbox,
       languageModelMiddleware: hooks?.languageModelMiddleware,
       usageRecorder: hooks?.usageRecorder,
+      toolExecutionContext: hooks?.toolExecutionContext,
       streamIdFactory: hooks?.streamIdFactory
     },
     subagentId,
@@ -830,26 +829,25 @@ async function runEndpointDocumentationAgent(opts) {
       method: displayMethod,
       path: endpoint.path
     }
-  });
-  try {
-    await (agentLimiter ? agentLimiter(spawnChild) : spawnChild());
-    return true;
-  } catch (error) {
-    log3.error(`"${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
-    return false;
-  }
+  };
 }
 async function runAppEndpointDocumentation(opts) {
   const { endpoints, ...shared } = opts;
   if (endpoints.length === 0)
     return;
   const spawner = opts.subagentSpawner ?? inProcessSubagentSpawner;
+  const requests = endpoints.map((endpoint) => endpointDocumentationSpawnOptions({ ...shared, endpoint }));
+  const results = await spawnBatch(spawner, requests, {
+    concurrency: ENDPOINT_DOCUMENTATION_CONCURRENCY,
+    abortSignal: opts.abortSignal
+  }, opts.agentLimiter);
   let anyFailed = false;
-  await spawner.spawnMany(endpoints, async (endpoint) => {
-    const ok = await runEndpointDocumentationAgent({ ...shared, endpoint });
-    if (!ok)
+  for (const [index, result] of results.entries()) {
+    if (result.status === "rejected") {
       anyFailed = true;
-  }, { concurrency: ENDPOINT_DOCUMENTATION_CONCURRENCY });
+      log3.error(`"${requests[index].subagentId}" FAILED`, result.reason instanceof Error ? result.reason : undefined, { error: String(result.reason) });
+    }
+  }
   if (anyFailed) {
     throw new Error(`One or more endpoint documentation agents failed for app ${opts.app.name}`);
   }
@@ -7087,60 +7085,72 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
   const appNodeId = `app:${sanitizeName(app.name)}`;
   const hooksForApp = resolveItemHooks(sharedHooks, seams, app, appIndex);
   let failed = false;
-  const spawnDiscoveryAgent = async (type, objective) => {
+  const discoveryRequest = (type, objective) => {
     const subagentId = mintChildId(TASK_TYPE_LABELS[type]);
     log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type}, appType=${app.type})`);
-    const spawner = subagentSpawner ?? inProcessSubagentSpawner;
-    try {
-      await agentLimiter(() => spawner.spawn({
-        spec: {
-          type: "code",
-          codebasePath,
-          objective,
-          system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
-          excludeTools: ["document_app"],
-          responseSchema: DiscoverySummarySchema2,
-          projectThreatModel,
-          attackSurfaceRegistry
-        },
-        runtime: {
-          findingPolicy: hooksForApp.findingPolicy,
-          model,
-          session,
-          authConfig,
-          abortSignal,
-          enableThinking,
-          thinkingEffort,
-          openAIReasoningEffort,
-          onStepFinish,
-          onCacheMetrics,
-          backends: hooksForApp.backends,
-          sandbox: hooksForApp.sandbox,
-          languageModelMiddleware: hooksForApp.languageModelMiddleware,
-          usageRecorder: hooksForApp.usageRecorder,
-          streamIdFactory: hooksForApp.streamIdFactory
-        },
-        subagentId,
-        subagentName: TASK_TYPE_LABELS[type],
-        parentBus: eventBus,
-        parentSubagentId: appNodeId,
-        lifecycleInput: { app: app.name, type }
-      }));
-      log4.debug(`Phase 2: agent "${subagentId}" completed`);
-    } catch (error) {
-      log4.error(`Phase 2: agent "${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
-      failed = true;
+    return {
+      spec: {
+        type: "code",
+        codebasePath,
+        objective,
+        system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
+        excludeTools: ["document_app"],
+        responseSchema: DiscoverySummarySchema2,
+        projectThreatModel,
+        attackSurfaceRegistry
+      },
+      runtime: {
+        findingPolicy: hooksForApp.findingPolicy,
+        model,
+        session,
+        authConfig,
+        abortSignal,
+        enableThinking,
+        thinkingEffort,
+        openAIReasoningEffort,
+        onStepFinish,
+        onCacheMetrics,
+        backends: hooksForApp.backends,
+        sandbox: hooksForApp.sandbox,
+        languageModelMiddleware: hooksForApp.languageModelMiddleware,
+        usageRecorder: hooksForApp.usageRecorder,
+        toolExecutionContext: hooksForApp.toolExecutionContext,
+        streamIdFactory: hooksForApp.streamIdFactory
+      },
+      subagentId,
+      subagentName: TASK_TYPE_LABELS[type],
+      parentBus: eventBus,
+      parentSubagentId: appNodeId,
+      lifecycleInput: { app: app.name, type }
+    };
+  };
+  const spawnDiscoveryAgents = async (requests) => {
+    const results = await spawnBatch(subagentSpawner ?? inProcessSubagentSpawner, requests, {
+      concurrency: requests.length,
+      abortSignal
+    }, agentLimiter);
+    for (const [index, result] of results.entries()) {
+      const subagentId = requests[index].subagentId;
+      if (result.status === "rejected") {
+        failed = true;
+        log4.error(`Phase 2: agent "${subagentId}" FAILED`, result.reason instanceof Error ? result.reason : undefined, { error: String(result.reason) });
+      } else {
+        log4.debug(`Phase 2: agent "${subagentId}" completed`);
+      }
     }
   };
-  const spawnPagesAgent = () => spawnDiscoveryAgent("pages", buildPagesDiscoveryObjective(codebasePath, app));
-  const spawnApiEndpointsAgent = () => spawnDiscoveryAgent("apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app));
-  const spawnCloudResourceAgent = () => spawnDiscoveryAgent("cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments));
+  const discoverPagesAndApi = () => spawnDiscoveryAgents([
+    discoveryRequest("pages", buildPagesDiscoveryObjective(codebasePath, app)),
+    discoveryRequest("apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app))
+  ]);
   try {
     if (NON_SERVICE_TYPES.includes(app.type)) {
-      await spawnCloudResourceAgent();
+      await spawnDiscoveryAgents([
+        discoveryRequest("cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments))
+      ]);
     } else if (!surfaceIntegrationEnabled) {
       log4.debug(`${app.name}: legacy (surfaceIntegrationEnabled=false)`);
-      await Promise.all([spawnPagesAgent(), spawnApiEndpointsAgent()]);
+      await discoverPagesAndApi();
     } else {
       const surfaceResult = mapAppWithSurface(join16(codebasePath, app.location), codebasePath, { isSingleAppRepo });
       if (surfaceResult.mode === "surface") {
@@ -7170,7 +7180,7 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
         });
       } else {
         log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
-        await Promise.all([spawnPagesAgent(), spawnApiEndpointsAgent()]);
+        await discoverPagesAndApi();
       }
     }
   } catch {
@@ -8190,7 +8200,7 @@ async function runPentestSwarm2(input) {
 }
 async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-v0r461wn.js");
+    const { runFastStrike } = await import("./fastStrike-67ajjp5k.js");
     return runFastStrike(input);
   }
   const {

package/build/{cli-cs7hsb1w.js → cli-1dm8x61n.js}

@@ -4,10 +4,10 @@ import {
   openSqliteRunStore,
   resolveWorkerEndpoint,
   workerRequest
-} from "./cli-ahk627k3.js";
+} from "./cli-d47vhcxp.js";
 import {
   launchLocalWorker
-} from "./cli-k8m6737j.js";
+} from "./cli-sfpjmf8c.js";
 
 // src/core/runtime/recordedRunClient.ts
 import { setTimeout as delay } from "node:timers/promises";

package/build/{cli-1wtxf161.js → cli-3cw5r290.js}

@@ -1,11 +1,12 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-ene4g09p.js";
+} from "./cli-ae6crt8f.js";
 
 // src/core/agents/agentRuntime.ts
 function assembleAgentHooks(opts) {
   return {
     findingPolicy: opts.findingPolicy,
+    toolExecutionContext: opts.toolExecutionContext,
     backends: opts.backends,
     subagentSpawner: opts.subagentSpawner,
     languageModelMiddleware: opts.languageModelMiddleware,

package/build/{cli-mpmpfce6.js → cli-72p3tb5s.js}

@@ -1,15 +1,15 @@
 import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema
-} from "./cli-ene4g09p.js";
+} from "./cli-ae6crt8f.js";
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1wtxf161.js";
+} from "./cli-3cw5r290.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-mm2vxyne.js";
+} from "./cli-hsk2jkfx.js";
 import {
   tool
 } from "./cli-pwm29ks7.js";